A help-desk role that previously could only reset passwords can suddenly delete production databases in the city's cloud account. What security issue should be investigated?
Select an answer to reveal the explanation.
Short Explanation
When the help desk can drop production databases, someone handed them the master keys by accident. Hunt for over-broad IAM changes or privilege escalation, then pull those permissions back.
Full Explanation
Sudden ability to destroy production data from a low-privilege role indicates privilege escalation or overly permissive policy or group changes. Cloud security troubleshooting should review IAM policy diffs, group membership, and access audits. Network MTU, DNS propagation, and storage retrieval pricing do not explain unauthorized destructive permissions.